Wireless:
Vulnerability Discovery
Guides for finding weak wireless configs and attack surfaces
Detecting Captive Portal Bypass Opportunities
Identifies misconfigured captive portals by probing DNS leaks, unauthenticated routes, and protocol-level bypasses to gain unauthorized network access.
Detecting Open Wireless Networks
Identify unsecured wireless networks lacking authentication using passive scanning tools like Kismet and airodump-ng to map exposure and assess risk.
Detecting WEP Networks
Scan for legacy WEP-encrypted wireless networks using tools like airodump-ng, identifying weak encryption targets vulnerable to cryptographic attacks.
Detecting WPA Enterprise PEAP Without Certificate Validation
Identifies misconfigured WPA Enterprise PEAP deployments lacking server certificate validation, enabling credential interception via rogue access point attacks.
Detecting WPA2 Networks Without MFP
Identifies WPA2 networks lacking Management Frame Protection via beacon frame analysis, exposing targets vulnerable to deauth attacks and rogue AP spoofing.
Detecting WPS Vulnerable Networks
Identifies WPS-enabled networks susceptible to Pixie Dust and brute-force PIN attacks using tools like Wash and Reaver to assess wireless security posture.
WPA3 SAE Dragonblood Vulnerabilities
Explores WPA3 SAE Dragonblood flaws including side-channel attacks, downgrade vectors, and cache-based leaks enabling offline dictionary attacks.
What this phase covers
Vulnerability discovery proves what is exploitable before you exploit it. Each page here confirms a specific weakness and states what attack it enables. The goal is a clear list of confirmed findings before the exploitation phase begins.
Open networks and WEP networks are the highest severity findings , both are immediately exploitable with no further steps. Unlocked WPS networks are the next priority, particularly those running on Ralink or Realtek chipsets which are likely Pixie Dust vulnerable. WPA2 without MFP confirms the deauthentication attack surface for handshake capture. WPA Enterprise with unvalidated certificates is a critical finding that exposes Active Directory credentials. Captive portal bypass maps which evasion techniques apply before attempting access.
Priority order
Work through targets in this order: open networks first (no attack needed, just capture), then WEP (broken encryption, crackable in minutes), then unlocked WPS (PIN or Pixie Dust bypasses the passphrase entirely), then WPA2 PSK without MFP (deauth and crack), then WPA Enterprise (rogue AP credential harvest). A network may have multiple weaknesses , an AP can be WPA2 PSK without MFP and also have WPS enabled, in which case try WPS first since it recovers the passphrase directly without needing to crack a handshake.
Flows into
Each confirmed finding maps directly to an exploitation page: open networks to plaintext capture, WEP to WEP cracking, WPS to Pixie Dust or PIN brute-force, WPA2 PSK to handshake capture and cracking, WPA Enterprise to EAP harvesting, and captive portals to the captive portal credential harvesting page.